Hey,

also hab mein Pc mal durchscannen lassen mit a-squared free und mit Malwarebytes.
So bei a-squared kommt folgendes: a-squared free v. 4.5.0.21
(C) 2003-2009 Emsi Software GmbH - www.****.com

ID Object
0 C:\Programme\Zwunzi\zwunzi.dll Gen.AdWare!IK
1 C:\Programme\Zwunzi\zwunzi.dll Gen.AdWare!IK
2 C:\Dokumente und Einstellungen\*******\Anwendungsdaten\Mozilla\Firefox\Profiles\cyb75ufk.default\cookies.sqlite:1244886660750000 Trace.TrackingCookie.pop!A2
3 C:\Dokumente und Einstellungen\*******\Anwendungsdaten\Mozilla\Firefox\Profiles\cyb75ufk.default\cookies.sqlite:1244887201578127 Trace.TrackingCookie.humanclick!A2
4 C:\Dokumente und Einstellungen\*******\Anwendungsdaten\Mozilla\Firefox\Profiles\cyb75ufk.default\cookies.sqlite:1244832734500003 Trace.TrackingCookie.count!A2
5 C:\Dokumente und Einstellungen\*******\Anwendungsdaten\Mozilla\Firefox\Profiles\cyb75ufk.default\cookies.sqlite:1244887191265625 Trace.TrackingCookie.pop!A2
6 C:\Dokumente und Einstellungen\*******\Cookies\can_gabsha@adtech[1].txt Trace.TrackingCookie.adtech!A2
7 C:\Dokumente und Einstellungen\*******\Cookies\can_gabsha@bs.serving-sys[1].txt Trace.TrackingCookie.bs.serving-sys!A2
8 C:\Dokumente und Einstellungen\*******\Anwendungsdaten\Mozilla\Firefox\Profiles\cyb75ufk.default\cookies.sqlite:1244887709250000 Trace.TrackingCookie.pop!A2
9 C:\Dokumente und Einstellungen\*******\Cookies\can_gabsha@weborama[2].txt Trace.TrackingCookie.weborama!A2
10 C:\Dokumente und Einstellungen\*******\Anwendungsdaten\Mozilla\Firefox\Profiles\cyb75ufk.default\cookies.sqlite:1244832734500004 Trace.TrackingCookie.count!A2
11 C:\Dokumente und Einstellungen\*******\Anwendungsdaten\Mozilla\Firefox\Profiles\cyb75ufk.default\cookies.sqlite:1244886825640625 Trace.TrackingCookie.pop!A2
12 C:\Dokumente und Einstellungen\*******\Cookies\can_gabsha@serving-sys[2].txt Trace.TrackingCookie.serving-sys!A2
13 C:\Dokumente und Einstellungen\*******\Anwendungsdaten\Mozilla\Firefox\Profiles\cyb75ufk.default\cookies.sqlite:1244887201578125 Trace.TrackingCookie.humanclick!A2

bei Malwarebytes:

Scan-Methode: Vollständiger Scan (C:\|D:\|E:\|)
Durchsuchte Objekte: 168512
Laufzeit: 49 minute(s), 57 second(s)

Infizierte Speicherprozesse: 0
Infizierte Speichermodule: 0
Infizierte Registrierungsschlüssel: 0
Infizierte Registrierungswerte: 0
Infizierte Dateiobjekte der Registrierung: 0
Infizierte Verzeichnisse: 0
Infizierte Dateien: 0

Infizierte Speicherprozesse:
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte:
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung:
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse:
(Keine bösartigen Objekte gefunden)

Infizierte Dateien:
(Keine bösartigen Objekte gefunden)

-->C:\Programme\DivX\DivXConverterUninstall.exe /CONVERTER
-->rundll32.exe setupapi.dll,InstallHinfSection DefaultUninstall 132 C:\WINXP\INF\PCHealth.inf
Adobe Flash Player 10 Plugin-->C:\WINXP\system32\Macromed\Flash\uninstall_plugin.exe
Adobe Reader 9.2 - Deutsch-->MsiExec.exe /I{AC76BA86-7AD7-1031-7B44-A92000000001}
Alice-Installationsdateien entfernen-->C:\Programme\Gemeinsame Dateien\Alice\uninst.exe
a-squared Free 4.0-->"C:\Programme\a-squared Free\unins000.exe"
Atheros Communications Inc.(R) L1 Gigabit Ethernet Driver-->RunDll32 C:\PROGRA~1\GEMEIN~1\INSTAL~1\PROFES~1\RunTime\11\00\Intel32\Ctor.dll,LaunchSetup "C:\Programme\InstallShield Installation Information\{6E19F210-3813-4002-B561-94D66AA182B6}\Setup.exe" -l0x9 -removeonly
ATI - Software Uninstall Utility-->C:\Programme\ATI Technologies\UninstallAll\AtiCimUn.exe
ATI Catalyst Control Center-->RunDll32 C:\PROGRA~1\GEMEIN~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Programme\InstallShield Installation Information\{055EE59D-217B-43A7-ABFF-507B966405D8}\setup.exe" -l0x5c3a
ATI Display Driver-->rundll32 C:\WINXP\system32\atiiiexx.dll,_InfEngUnInstallINFFile_RunDLL@16 -force_restart -flags:0x2010001 -inf_classISPLAY -clean
Audio Recorder for FREE 2009 v12.6.1-->"C:\Programme\Audio Recorder for FREE\unins000.exe"
Avira AntiVir Personal - Free Antivirus-->C:\Programme\Avira\AntiVir Desktop\setup.exe /REMOVE
CCleaner-->"C:\Programme\CCleaner\uninst.exe"
ConvertXtoDVD 3.7.3.190b-->"C:\Programme\VSO\ConvertX\3\unins000.exe"
Counter-Strike: Source-->"C:\Programme\Steam\steam.exe" steam://uninstall/240
Digital Photo Navigator 1.5-->RunDll32 C:\PROGRA~1\GEMEIN~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Programme\InstallShield Installation Information\{CF9CD37C-E29A-11D5-AE3D-005004B8E30C}\setup.EXE" -l0x9
DivX Codec-->C:\Programme\DivX\DivXCodecUninstall.exe /CODEC
DivX Converter-->C:\Programme\DivX\DivXConverterUninstall.exe /CONVERTER
DivX Player-->C:\Programme\DivX\DivXPlayerUninstall.exe /PLAYER
DivX Plus DirectShow Filters-->C:\Programme\DivX\DivXDSFiltersUninstall.exe /DSFILTERS
DivX Plus Web Player-->C:\Programme\DivX\DivXWebPlayerUninstall.exe /PLUGIN
Free YouTube to iPod Converter version 3.1-->"C:\Programme\DVDVideoSoft\Free YouTube to iPod Converter\unins000.exe"
Free YouTube to Mp3 Converter version 3.1-->"C:\Programme\DVDVideoSoft\Free YouTube to Mp3 Converter\unins000.exe"
Google Chrome-->"C:\Programme\Google\Chrome\Application\3.0.195.33\Installer\setup.exe" --uninstall --system-level
Google Update Helper-->MsiExec.exe /I{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}
High Definition Audio Driver Package - KB888111-->"C:\WINXP\$NtUninstallKB888111WXPSP2$\spuninst\spuninst.exe"
HijackThis 2.0.2-->"C:\Programme\Trend Micro\HijackThis\HijackThis.exe" /uninstall
Hotfix für Windows Media Player 11 (KB939683)-->"C:\WINXP\$NtUninstallKB939683$\spuninst\spuninst.exe"
Hotfix für Windows XP (KB952287)-->"C:\WINXP\$NtUninstallKB952287$\spuninst\spuninst.exe"
iTunes-->MsiExec.exe /I{CC5702D7-86E2-45A8-99D7-E8B976ADCC56}
Java(TM) 6 Update 13-->MsiExec.exe /X{26A24AE4-039D-4CA4-87B4-2F83216013FF}
Java(TM) 6 Update 7-->MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0160070}
Junk Mail filter update-->MsiExec.exe /I{E2DFE069-083E-4631-9B6C-43C48E991DE5}
Keyboard Music 2.4-->"C:\Programme\Keyboard Music 2.4\unins000.exe"
LiveUpdate 3.2 (Symantec Corporation)-->"C:\Programme\Symantec\LiveUpdate\LSETUP.EXE" /U
LiveUpdate Notice (Symantec Corporation)-->MsiExec.exe /X{DBA4DB9D-EE51-4944-A419-98AB1F1249C8}
LowRateVoip-->"C:\Programme\LowRateVoip\unins000.exe"
Malwarebytes' Anti-Malware-->"C:\Programme\Malwarebytes' Anti-Malware\unins000.exe"
Microsoft .NET Framework 2.0-->C:\WINXP\Microsoft.NET\Framework\v2.0.50727\Microsoft .NET Framework 2.0\install.exe
Microsoft Age of Empires II-->"C:\Dokumente und Einstellungen\UNINSTAL.EXE" /runtemp /uninstall
Microsoft Choice Guard-->MsiExec.exe /X{F0E12BBA-AD66-4022-A453-A1C8A0C4D570}
Microsoft Kernel-Mode Driver Framework Feature Pack 1.5-->"C:\WINXP\$NtUninstallWdf01005$\spuninst\spuninst.exe"
Microsoft Office PowerPoint Viewer 2007 (German)-->MsiExec.exe /X{95120000-00AF-0407-0000-0000000FF1CE}
Microsoft Search Enhancement Pack-->MsiExec.exe /I{9C9CEB9D-53FD-49A7-85D2-FE674F72F24E}
Microsoft Silverlight-->MsiExec.exe /X{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}
Microsoft SQL Server 2005 Compact Edition [ENU]-->MsiExec.exe /I{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}
Microsoft Sync Framework Runtime Native v1.0 (x86)-->MsiExec.exe /I{8A74E887-8F0F-4017-AF53-CBA42211AAA5}
Microsoft Sync Framework Services Native v1.0 (x86)-->MsiExec.exe /I{BD64AF4A-8C80-4152-AD77-FCDDF05208AB}
Microsoft User-Mode Driver Framework Feature Pack 1.5-->"C:\WINXP\$NtUninstallWudf01005$\spuninst\spuninst.exe"
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17-->MsiExec.exe /X{9A25302D-30C0-39D9-BD6F-21E6EC160475}
Mozilla Firefox (3.5.5)-->C:\Programme\Mozilla Firefox\uninstall\helper.exe
MSN-->C:\Programme\MSN\MsnInstaller\msninst.exe /Action:ARP
MSVCRT-->MsiExec.exe /I{22B775E7-6C42-4FC5-8E10-9A5E3257BD94}
MSXML 4.0 SP2 (KB936181)-->MsiExec.exe /I{C04E32E0-0416-434D-AFB9-6969D703A9EF}
MSXML 4.0 SP2 (KB954430)-->MsiExec.exe /I{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}
neroxml-->MsiExec.exe /I{56C049BE-79E9-4502-BEA7-9754A3E60F9B}
OpenOffice.org 3.1-->MsiExec.exe /I{D765F1CE-5AE5-4C47-B134-AE58AC474740}
P.M. Trainer BD. 1-->RunDll32 C:\PROGRA~1\GEMEIN~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Programme\InstallShield Installation Information\{CE46CCB0-D5D2-4996-AF6C-B29EF5C8CDBF}\Setup.exe"
Pando Media Booster-->C:\Programme\Pando Networks\Media Booster\uninst.exe
PC Connectivity Solution-->MsiExec.exe /I{6094AB91-4CC8-498E-9DFF-134CC0B159DE}
PowerCinema NE for Everio-->RunDll32 C:\PROGRA~1\GEMEIN~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Programme\InstallShield Installation Information\{39CEE1F2-12B6-4C50-9131-04BFCA110578}\setup.exe" -uninstall
PowerDirector Express-->RunDll32 C:\PROGRA~1\GEMEIN~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Programme\InstallShield Installation Information\{EDE721EC-870A-11D8-9D75-000129760D75}\setup.exe" -uninstall
PowerProducer-->RunDll32 C:\PROGRA~1\GEMEIN~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Programme\InstallShield Installation Information\{B7A0CE06-068E-11D6-97FD-0050BACBF861}\setup.exe" -uninstall
PunkBuster Services-->C:\WINXP\system32\pbsvc.exe -u
QuickTime-->MsiExec.exe /I{C78EAC6F-7A73-452E-8134-DBB2165C5A68}
Realtek High Definition Audio Driver-->RtlUpd.exe -r -m -nrg2709
SAMSUNG Mobile USB Modem 1.0 Software-->C:\WINXP\system32\Samsung_USB_Drivers\1\SS_Uninstall.exe
SAMSUNG Mobile USB Modem Software-->C:\WINXP\system32\Samsung_USB_Drivers\2\SSM_Uninstall.exe
Samsung PC Studio 3 USB Driver Installer-->RunDll32 C:\PROGRA~1\GEMEIN~1\INSTAL~1\PROFES~1\RunTime\10\50\Intel32\Ctor.dll,LaunchSetup "C:\Programme\InstallShield Installation Information\{EBA29752-DDD2-4B62-B2E3-9841F92A3E3A}\setup.exe" -l0x7 -removeonly
Secunia PSI-->"C:\Programme\Secunia\PSI\uninstall.exe"
Segoe UI-->MsiExec.exe /I{A1F66FC9-11EE-4F2F-98C9-16F8D1E69FB7}
Sicherheitsupdate für Windows Internet Explorer 7 (KB950759)-->"C:\WINXP\ie7updates\KB950759-IE7\spuninst\spuninst.exe"
Sicherheitsupdate für Windows Internet Explorer 7 (KB953838)-->"C:\WINXP\ie7updates\KB953838-IE7\spuninst\spuninst.exe"
Sicherheitsupdate für Windows Internet Explorer 7 (KB956390)-->"C:\WINXP\ie7updates\KB956390-IE7\spuninst\spuninst.exe"
Sicherheitsupdate für Windows Internet Explorer 7 (KB958215)-->"C:\WINXP\ie7updates\KB958215-IE7\spuninst\spuninst.exe"
Sicherheitsupdate für Windows Internet Explorer 7 (KB960714)-->"C:\WINXP\ie7updates\KB960714-IE7\spuninst\spuninst.exe"
Sicherheitsupdate für Windows Internet Explorer 7 (KB961260)-->"C:\WINXP\ie7updates\KB961260-IE7\spuninst\spuninst.exe"
Sicherheitsupdate für Windows Internet Explorer 7 (KB963027)-->"C:\WINXP\ie7updates\KB963027-IE7\spuninst\spuninst.exe"
Sicherheitsupdate für Windows Internet Explorer 7 (KB969897)-->"C:\WINXP\ie7updates\KB969897-IE7\spuninst\spuninst.exe"
Sicherheitsupdate für Windows Media Player (KB952069)-->"C:\WINXP\$NtUninstallKB952069_WM9$\spuninst\spuninst.exe"
Sicherheitsupdate für Windows Media Player 11 (KB936782)-->"C:\WINXP\$NtUninstallKB936782_WMP11$\spuninst\spuninst.exe"
Sicherheitsupdate für Windows Media Player 11 (KB954154)-->"C:\WINXP\$NtUninstallKB954154_WM11$\spuninst\spuninst.exe"
Sicherheitsupdate für Windows XP (KB923561)-->"C:\WINXP\$NtUninstallKB923561$\spuninst\spuninst.exe"
Sicherheitsupdate für Windows XP (KB923789)-->C:\WINXP\system32\MacroMed\Flash\genuinst.exe C:\WINXP\system32\MacroMed\Flash\KB923789.inf
Sicherheitsupdate für Windows XP (KB938464)-->"C:\WINXP\$NtUninstallKB938464$\spuninst\spuninst.exe"
Sicherheitsupdate für Windows XP (KB938464-v2)-->"C:\WINXP\$NtUninstallKB938464-v2$\spuninst\spuninst.exe"
Sicherheitsupdate für Windows XP (KB946648)-->"C:\WINXP\$NtUninstallKB946648$\spuninst\spuninst.exe"
Sicherheitsupdate für Windows XP (KB950760)-->"C:\WINXP\$NtUninstallKB950760$\spuninst\spuninst.exe"
Sicherheitsupdate für Windows XP (KB950762)-->"C:\WINXP\$NtUninstallKB950762$\spuninst\spuninst.exe"
Sicherheitsupdate für Windows XP (KB950974)-->"C:\WINXP\$NtUninstallKB950974$\spuninst\spuninst.exe"
Sicherheitsupdate für Windows XP (KB951066)-->"C:\WINXP\$NtUninstallKB951066$\spuninst\spuninst.exe"
Sicherheitsupdate für Windows XP (KB951376-v2)-->"C:\WINXP\$NtUninstallKB951376-v2$\spuninst\spuninst.exe"
Sicherheitsupdate für Windows XP (KB951698)-->"C:\WINXP\$NtUninstallKB951698$\spuninst\spuninst.exe"
Sicherheitsupdate für Windows XP (KB951748)-->"C:\WINXP\$NtUninstallKB951748$\spuninst\spuninst.exe"
Sicherheitsupdate für Windows XP (KB952004)-->"C:\WINXP\$NtUninstallKB952004$\spuninst\spuninst.exe"
Sicherheitsupdate für Windows XP (KB952954)-->"C:\WINXP\$NtUninstallKB952954$\spuninst\spuninst.exe"
Sicherheitsupdate für Windows XP (KB953839)-->"C:\WINXP\$NtUninstallKB953839$\spuninst\spuninst.exe"
Sicherheitsupdate für Windows XP (KB954211)-->"C:\WINXP\$NtUninstallKB954211$\spuninst\spuninst.exe"
Sicherheitsupdate für Windows XP (KB954459)-->"C:\WINXP\$NtUninstallKB954459$\spuninst\spuninst.exe"
Sicherheitsupdate für Windows XP (KB954600)-->"C:\WINXP\$NtUninstallKB954600$\spuninst\spuninst.exe"
Sicherheitsupdate für Windows XP (KB955069)-->"C:\WINXP\$NtUninstallKB955069$\spuninst\spuninst.exe"
Sicherheitsupdate für Windows XP (KB956391)-->"C:\WINXP\$NtUninstallKB956391$\spuninst\spuninst.exe"
Sicherheitsupdate für Windows XP (KB956572)-->"C:\WINXP\$NtUninstallKB956572$\spuninst\spuninst.exe"
Sicherheitsupdate für Windows XP (KB956802)-->"C:\WINXP\$NtUninstallKB956802$\spuninst\spuninst.exe"
Sicherheitsupdate für Windows XP (KB956803)-->"C:\WINXP\$NtUninstallKB956803$\spuninst\spuninst.exe"
Sicherheitsupdate für Windows XP (KB956841)-->"C:\WINXP\$NtUninstallKB956841$\spuninst\spuninst.exe"
Sicherheitsupdate für Windows XP (KB957095)-->"C:\WINXP\$NtUninstallKB957095$\spuninst\spuninst.exe"
Sicherheitsupdate für Windows XP (KB957097)-->"C:\WINXP\$NtUninstallKB957097$\spuninst\spuninst.exe"
Sicherheitsupdate für Windows XP (KB958644)-->"C:\WINXP\$NtUninstallKB958644$\spuninst\spuninst.exe"
Sicherheitsupdate für Windows XP (KB958687)-->"C:\WINXP\$NtUninstallKB958687$\spuninst\spuninst.exe"
Sicherheitsupdate für Windows XP (KB958690)-->"C:\WINXP\$NtUninstallKB958690$\spuninst\spuninst.exe"
Sicherheitsupdate für Windows XP (KB959426)-->"C:\WINXP\$NtUninstallKB959426$\spuninst\spuninst.exe"
Sicherheitsupdate für Windows XP (KB960225)-->"C:\WINXP\$NtUninstallKB960225$\spuninst\spuninst.exe"
Sicherheitsupdate für Windows XP (KB960715)-->"C:\WINXP\$NtUninstallKB960715$\spuninst\spuninst.exe"
Sicherheitsupdate für Windows XP (KB960803)-->"C:\WINXP\$NtUninstallKB960803$\spuninst\spuninst.exe"
Sicherheitsupdate für Windows XP (KB961373)-->"C:\WINXP\$NtUninstallKB961373$\spuninst\spuninst.exe"
Sicherheitsupdate für Windows XP (KB961501)-->"C:\WINXP\$NtUninstallKB961501$\spuninst\spuninst.exe"
Sicherheitsupdate für Windows XP (KB968537)-->"C:\WINXP\$NtUninstallKB968537$\spuninst\spuninst.exe"
Sicherheitsupdate für Windows XP (KB969898)-->"C:\WINXP\$NtUninstallKB969898$\spuninst\spuninst.exe"
Sicherheitsupdate für Windows XP (KB970238)-->"C:\WINXP\$NtUninstallKB970238$\spuninst\spuninst.exe"
Spybot - Search & Destroy-->"C:\Programme\Spybot - Search & Destroy\unins000.exe"
Steam-->MsiExec.exe /X{048298C9-A4D3-490B-9FF9-AB023A9238F3}
TeamSpeak 2 RC2-->C:\Programme\Teamspeak2_RC2\unins000.exe
Uninstall 1.0.0.1-->"C:\Programme\Gemeinsame Dateien\DVDVideoSoft\unins000.exe"
Update für Windows XP (KB951072-v2)-->"C:\WINXP\$NtUninstallKB951072-v2$\spuninst\spuninst.exe"
Update für Windows XP (KB951978)-->"C:\WINXP\$NtUninstallKB951978$\spuninst\spuninst.exe"
Update für Windows XP (KB955839)-->"C:\WINXP\$NtUninstallKB955839$\spuninst\spuninst.exe"
Update für Windows XP (KB967715)-->"C:\WINXP\$NtUninstallKB967715$\spuninst\spuninst.exe"
VC80CRTRedist - 8.0.50727.4053-->MsiExec.exe /I{5EE7D259-D137-4438-9A5F-42F432EC0421}
VCRedistSetup-->MsiExec.exe /I{3921A67A-5AB1-4E48-9444-C71814CF3027}
VLC media player 1.0.1-->C:\Programme\VideoLAN\VLC\uninstall.exe
Warcraft III-->C:\Programme\Gemeinsame Dateien\Blizzard Entertainment\Warcraft III\Uninstall.exe
Wichtiges Update für Windows Media Player 11 (KB959772)-->"C:\WINXP\$NtUninstallKB959772_WM11$\spuninst\spuninst.exe"
Windows Driver Package - Nokia (WUDFRd) WPD (03/19/2007 6.83.31.1)-->C:\PROGRA~1\DIFX\D6ACC4BE676423A2B130B78A4B627FC457D98997\dpinst.exe /u C:\WINXP\system32\DRVSTORE\pccswpddri_039E7E24575DBAE6A389611AF28F4EB97729D33E\pccswpddriver.inf
Windows Live Call-->MsiExec.exe /I{F6BD194C-4190-4D73-B1B1-C48C99921BFE}
Windows Live Communications Platform-->MsiExec.exe /I{3B4E636E-9D65-4D67-BA61-189800823F52}
Windows Live Essentials-->C:\Programme\Windows Live\Installer\wlarp.exe
Windows Live Essentials-->MsiExec.exe /I{81128EE8-8EAD-4DB0-85C6-17C2CE50FF71}
Windows Live Family Safety-->MsiExec.exe /X{139E303E-1050-497F-98B1-9AE87B15C463}
Windows Live Mail-->MsiExec.exe /I{6412CECE-8172-4BE5-935B-6CECACD2CA87}
Windows Live Messenger-->MsiExec.exe /X{A85FD55B-891B-4314-97A5-EA96C0BD80B5}
Windows Live Photo Gallery-->MsiExec.exe /X{D6C75F0B-3BC1-4FC9-B8C5-3F7E8ED059CA}
Windows Live Sign-in Assistant-->MsiExec.exe /I{45338B07-A236-4270-9A77-EBB4115517B5}
Windows Live Sync-->MsiExec.exe /X{84EBDF39-4B33-49D7-A0BD-EB6E2C4E81C1}
Windows Live Toolbar-->MsiExec.exe /X{995F1E2E-F542-4310-8E1D-9926F5A279B3}
Windows Live Upload Tool-->MsiExec.exe /I{205C6BDD-7B73-42DE-8505-9A093F35A238}
Windows Live Writer-->MsiExec.exe /X{178832DE-9DE0-4C87-9F82-9315A9B03985}
Windows XP Service Pack 3-->"C:\WINXP\$NtServicePackUninstall$\spuninst\spuninst.exe"
Windows-Treiberpaket - Advanced Micro Devices (AmdK8) Processor (05/27/2006 1.3.2.0)-->C:\PROGRA~1\DIFX\7B44739871F4D539FA473F57A832EA4B6A59EF06\DPInst.exe /d /u C:\WINXP\system32\DRVSTORE\amdk8_87B606860B720724BEB5DCEB69E8628A61DE0A7E\amdk8.inf
WinRAR-->C:\Programme\WinRAR\uninstall.exe
World of Warcraft-->C:\Programme\Gemeinsame Dateien\Blizzard Entertainment\World of Warcraft Public Test-PTR (2)\Uninstall.exe
Xfire (remove only)-->"C:\Programme\Xfire\uninst.exe"
ZoneAlarm-->C:\Programme\Zone Labs\ZoneAlarm\zauninst.exe
Zwunzi 1.0 build 131-->C:\Programme\Zwunzi\uninstall.exe

=====HijackThis Backups=====

O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Programme\Spybot - Search & Destroy\TeaTimer.exe [2009-06-13]
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Programme\Java\jre1.6.0_07\bin\jusched.exe" [2009-06-13]
R3 - URLSearchHook: (no name) - - (no file) [2009-06-13]
O7 - HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System, DisableRegedit=1 [2009-06-13]
O2 - BHO: AskBar BHO - {201f27d4-3704-41d6-89c1-aa35e39143ed} - C:\Programme\AskBarDis\bar\bin\askBar.dll [2009-06-13]
O9 - Extra button: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Programme\ICQLite\ICQLite.exe (file missing) [2009-06-13]
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k [2009-06-13]
O4 - HKLM\..\Run: [QuickTime Task] "C:\Programme\QuickTime\qttask.exe" -atboottime [2009-06-13]
O9 - Extra 'Tools' menuitem: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Programme\ICQLite\ICQLite.exe (file missing) [2009-06-13]

======Security center information======

AV: AntiVir Desktop (outdated)
FW: ZoneAlarm Firewall

======System event log======

Computer Name: BIE
Event Code: 7036
Message: Dienst "IMAPI-CD-Brenn-COM-Dienste" befindet sich jetzt im Status "Beendet".

Record Number: 24649
Source Name: Service Control Manager
Time Written: 20091109015129.000000+270
Event Type: Informationen
User:

Computer Name: BIE
Event Code: 7036
Message: Dienst "WMI-Leistungsadapter" befindet sich jetzt im Status "Beendet".

Record Number: 24648
Source Name: Service Control Manager
Time Written: 20091109015123.000000+270
Event Type: Informationen
User:

Computer Name: BIE
Event Code: 7036
Message: Dienst "WMI-Leistungsadapter" befindet sich jetzt im Status "Ausgeführt".

Record Number: 24647
Source Name: Service Control Manager
Time Written: 20091109015123.000000+270
Event Type: Informationen
User:

Computer Name: BIE
Event Code: 7035
Message: Der Steuerbefehl "starten" wurde erfolgreich an den Dienst "WMI-Leistungsadapter" gesendet.

Record Number: 24646
Source Name: Service Control Manager
Time Written: 20091109015123.000000+270
Event Type: Informationen
User: NT-AUTORITÄT\SYSTEM

Computer Name: BIE
Event Code: 7036
Message: Dienst "IMAPI-CD-Brenn-COM-Dienste" befindet sich jetzt im Status "Ausgeführt".

Record Number: 24645
Source Name: Service Control Manager
Time Written: 20091109015122.000000+270
Event Type: Informationen
User:

=====Application event log=====

Computer Name: BIE
Event Code: 1007
Message: Der Endbenutzer-Lizenzvertrag wurde zuvor abgelehnt.

Record Number: 36797
Source Name: WgaSetup
Time Written: 20091030205657.000000+270
Event Type: Informationen
User:

Computer Name: BIE
Event Code: 1003
Message: Setup fehlgeschlagen. Code = 0x800704c7, Fehler = Der Vorgang wurde durch den Benutzer abgebrochen.


Record Number: 36796
Source Name: WgaSetup
Time Written: 20091030205657.000000+270
Event Type: Informationen
User:

Computer Name: BIE
Event Code: 1005
Message: Der Benutzer hat den Endbenutzer-Lizenzvertrag abgelehnt.

Record Number: 36795
Source Name: WgaSetup
Time Written: 20091030205657.000000+270
Event Type: Informationen
User:

Computer Name: BIE
Event Code: 0
Message:
Record Number: 36794
Source Name: iPod Service
Time Written: 20091030205332.000000+270
Event Type: Informationen
User:

Computer Name: BIE
Event Code: 0
Message:
Record Number: 36793
Source Name: LiveUpdate Notice Service
Time Written: 20091030205309.000000+270
Event Type: Informationen
User:

======Environment variables======

"ComSpec"=%SystemRoot%\system32\cmd.exe
"Path"=%systemroot%\system32;%systemroot%;%systemroot%\system32\wbem;C:\Programme\PC Connectivity Solution;C:\Programme\ATI Technologies\ATI.ACE\Core-Static;C:\Programme\QuickTime\QTSystem;C:\Programme\Gemeinsame Dateien\DivX Shared\
"windir"=%SystemRoot%
"FP_NO_HOST_CHECK"=NO
"OS"=Windows_NT
"PROCESSOR_ARCHITECTURE"=x86
"PROCESSOR_LEVEL"=15
"PROCESSOR_IDENTIFIER"=x86 Family 15 Model 107 Stepping 2, AuthenticAMD
"PROCESSOR_REVISION"=6b02
"NUMBER_OF_PROCESSORS"=2
"PATHEXT"=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH
"TEMP"=%SystemRoot%\TEMP
"TMP"=%SystemRoot%\TEMP
"CLASSPATH"=.;C:\Programme\Java\jre1.6.0_07\lib\ext\QTJava.zip
"QTJAVA"=C:\Programme\Java\jre1.6.0_07\lib\ext\QTJava.zip
"tvdumpflags"=8

-----------------EOF-----------------


Running processes:
C:\WINXP\System32\smss.exe
C:\WINXP\system32\winlogon.exe
C:\WINXP\system32\services.exe
C:\WINXP\system32\lsass.exe
C:\WINXP\system32\Ati2evxx.exe
C:\WINXP\system32\svchost.exe
C:\WINXP\System32\svchost.exe
C:\WINXP\system32\svchost.exe
C:\WINXP\system32\Ati2evxx.exe
C:\WINXP\system32\ZoneLabs\vsmon.exe
C:\WINXP\Explorer.EXE
C:\WINXP\system32\spoolsv.exe
C:\Programme\Avira\AntiVir Desktop\sched.exe
C:\PROGRAMME\A-SQUARED FREE\a2service.exe
C:\Programme\Avira\AntiVir Desktop\avguard.exe
C:\Programme\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\Programme\Java\jre6\bin\jqs.exe
C:\Programme\Gemeinsame Dateien\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
C:\WINXP\system32\PnkBstrA.exe
C:\Programme\CyberLink\Shared Files\RichVideo.exe
C:\Programme\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
C:\WINXP\system32\svchost.exe
C:\WINXP\system32\wscntfy.exe
C:\Programme\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
C:\WINXP\System32\svchost.exe
C:\Programme\ATI Technologies\ATI.ACE\Core-Static\ccc.exe
C:\WINXP\RTHDCPL.EXE
C:\Programme\Gemeinsame Dateien\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
C:\Programme\Avira\AntiVir Desktop\avgnt.exe
C:\Programme\iTunes\iTunesHelper.exe
C:\Programme\Zone Labs\ZoneAlarm\zlclient.exe
C:\Programme\CyberLink\PCM4Everio\EverioService.exe
C:\WINXP\system32\ctfmon.exe
C:\Programme\Windows Live\Messenger\msnmsgr.exe
C:\Programme\Pando Networks\Media Booster\PMB.exe
C:\Programme\Secunia\PSI\psi.exe
C:\Programme\Xfire\Xfire.exe
C:\Programme\iPod\bin\iPodService.exe
C:\Programme\Alice\Signup\AliceCnn.exe
C:\Programme\Windows Live\Contacts\wlcomm.exe
C:\Programme\Mozilla Firefox\firefox.exe
C:\Programme\Windows Live\Messenger\wlcsdk.exe
C:\Programme\a-squared Free\a2free.exe
C:\Programme\Malwarebytes' Anti-Malware\mbam.exe
C:\Dokumente und Einstellungen\***\Eigene Dateien\Downloads\RSIT.exe
C:\Programme\Trend Micro\HijackThis\***.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.de/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://alice.aol.de
R3 - URLSearchHook: (no name) - - (no file)
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
O2 - BHO: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Programme\Microsoft\Search Enhancement Pack\Search Helper\SearchHelper.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Programme\Java\jre6\bin\jp2ssv.dll
O2 - BHO: Windows Live Toolbar Helper - {E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} - C:\Programme\Windows Live\Toolbar\wltcore.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Programme\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: (no name) - {3041d03e-fd4b-44e0-b742-2d9b88305f98} - (no file)
O3 - Toolbar: &Windows Live Toolbar - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Programme\Windows Live\Toolbar\wltcore.dll
O4 - HKLM\..\Run: [StartCCC] "C:\Programme\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [Symantec PIF AlertEng] "C:\Programme\Gemeinsame Dateien\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /a /m "C:\Programme\Gemeinsame Dateien\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\AlertEng.dll"
O4 - HKLM\..\Run: [avgnt] "C:\Programme\Avira\AntiVir Desktop\avgnt.exe" /min
O4 - HKLM\..\Run: [QuickTime Task] "C:\Programme\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Programme\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Programme\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [EverioService] "C:\Programme\CyberLink\PCM4Everio\EverioService.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Programme\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Adobe ARM] "C:\Programme\Gemeinsame Dateien\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINXP\system32\ctfmon.exe
O4 - HKCU\..\Run: [Steam] "c:\programme\steam\steam.exe" -silent
O4 - HKCU\..\Run: [MsnMsgr] "C:\Programme\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [Pando Media Booster] C:\Programme\Pando Networks\Media Booster\PMB.exe
O4 - HKUS\S-1-5-18\..\RunOnce: [nltide_2] regsvr32 /s /n /i:U shell32 (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\RunOnce: [nltide_2] regsvr32 /s /n /i:U shell32 (User 'Default user')
O4 - Startup: Secunia PSI.lnk = C:\Programme\Secunia\PSI\psi.exe
O4 - Startup: Xfire.lnk = C:\Programme\Xfire\Xfire.exe
O9 - Extra button: Blog This - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Programme\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &Blog This in Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Programme\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINXP\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINXP\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{1AE22DB7-2958-497E-9AB1-412DB4B7DC66}: NameServer = 213.191.74.19 62.109.123.197
O23 - Service: a-squared Free Service (a2free) - Emsi Software GmbH - C:\PROGRAMME\A-SQUARED FREE\a2service.exe
O23 - Service: Avira AntiVir Planer (AntiVirSchedulerService) - Avira GmbH - C:\Programme\Avira\AntiVir Desktop\sched.exe
O23 - Service: Avira AntiVir Guard (AntiVirService) - Avira GmbH - C:\Programme\Avira\AntiVir Desktop\avguard.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINXP\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINXP\system32\ati2sgag.exe
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Programme\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: Google Update Service (gupdate1ca6a353e8650a2) (gupdate1ca6a353e8650a2) - Google Inc. - C:\Programme\Google\Update\GoogleUpdate.exe
O23 - Service: iPod-Dienst (iPod Service) - Apple Inc. - C:\Programme\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Programme\Java\jre6\bin\jqs.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: LiveUpdate Notice Service Ex (LiveUpdate Notice Ex) - Unknown owner - C:\Programme\Gemeinsame Dateien\Symantec Shared\ccSvcHst.exe (file missing)
O23 - Service: LiveUpdate Notice Service - Symantec Corporation - C:\Programme\Gemeinsame Dateien\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINXP\system32\PnkBstrA.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Programme\CyberLink\Shared Files\RichVideo.exe
O23 - Service: ServiceLayer - Nokia. - C:\Programme\PC Connectivity Solution\ServiceLayer.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINXP\system32\ZoneLabs\vsmon.exe
O23 - Service: Zwunzi Service - Unknown owner - C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Zwunzi\zwunzi131.exe

--
End of file - 9033 bytes

======Scheduled tasks folder======

C:\WINXP\tasks\GoogleUpdateTaskMachineCore.job
C:\WINXP\tasks\GoogleUpdateTaskMachineUA.job
C:\WINXP\tasks\WGASetup.job

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}]
Adobe PDF Link Helper - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2009-02-27 75128]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{53707962-6F74-2D53-2644-206D7942484F}]
Spybot-S&D IE Protection - C:\PROGRA~1\SPYBOT~1\SDHelper.dll [2009-01-26 1879896]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{5C255C8A-E604-49b4-9D64-90988571CECB}]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{6EBF7485-159F-4bff-A14F-B9E3AAC4465B}]
Search Helper - C:\Programme\Microsoft\Search Enhancement Pack\Search Helper\SearchHelper.dll [2009-01-14 92504]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9030D464-4C02-4ABF-8ECC-5164760863C6}]
Windows Live Sign-in Helper - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2009-01-22 408448]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper - C:\Programme\Java\jre6\bin\jp2ssv.dll [2009-06-13 35840]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{E15A8DC0-8516-42A1-81EA-DC94EC1ACF10}]
Windows Live Toolbar Helper - C:\Programme\Windows Live\Toolbar\wltcore.dll [2009-02-06 1068904]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{E7E6F031-17CE-4C07-BC86-EABFE594F69C}]
JQSIEStartDetectorImpl Class - C:\Programme\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll [2009-06-13 73728]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{3041d03e-fd4b-44e0-b742-2d9b88305f98}
{21FA44EF-376D-4D53-9B0F-8A89D3229068} - &Windows Live Toolbar - C:\Programme\Windows Live\Toolbar\wltcore.dll [2009-02-06 1068904]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"StartCCC"=C:\Programme\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [2008-01-21 61440]
"RTHDCPL"=C:\WINXP\RTHDCPL.EXE [2007-08-10 16384000]
"Symantec PIF AlertEng"=C:\Programme\Gemeinsame Dateien\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe [2008-01-29 583048]
"avgnt"=C:\Programme\Avira\AntiVir Desktop\avgnt.exe [2009-03-02 209153]
"QuickTime Task"=C:\Programme\QuickTime\qttask.exe [2009-05-26 413696]
"iTunesHelper"=C:\Programme\iTunes\iTunesHelper.exe [2009-05-30 292136]
"ZoneAlarm Client"=C:\Programme\Zone Labs\ZoneAlarm\zlclient.exe [2008-07-09 919016]
"EverioService"=C:\Programme\CyberLink\PCM4Everio\EverioService.exe [2007-11-01 151552]
"Adobe Reader Speed Launcher"=C:\Programme\Adobe\Reader 9.0\Reader\Reader_sl.exe [2009-10-03 35696]
"Adobe ARM"=C:\Programme\Gemeinsame Dateien\Adobe\ARM\1.0\AdobeARM.exe [2009-09-04 935288]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"=C:\WINXP\system32\ctfmon.exe [2008-04-14 15360]
"Steam"=c:\programme\steam\steam.exe [2009-06-11 1217784]
"MsnMsgr"=C:\Programme\Windows Live\Messenger\msnmsgr.exe [2009-07-26 3883856]
"Pando Media Booster"=C:\Programme\Pando Networks\Media Booster\PMB.exe [2009-11-08 2923192]

C:\Dokumente und Einstellungen\*** Gab**a\Startmenü\Programme\Autostart
Secunia PSI.lnk - C:\Programme\Secunia\PSI\psi.exe
Xfire.lnk - C:\Programme\Xfire\Xfire.exe

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\AtiExtEvent]
C:\WINXP\system32\Ati2evxx.dll [2008-06-03 139264]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\WgaLogon]
C:\WINXP\system32\WgaLogon.dll [2007-10-16 3584]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINXP\system32\wpdshserviceobj.dll [2007-10-09 133632]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\vsmon]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=323
"NoDriveAutoRun"=67108863
"NoDrives"=0

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"HonorAutoRunSetting"=
"NoDriveAutoRun"=
"NoDriveTypeAutoRun"=
"NoDrives"=

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\Programme\Steam\steamapps\trust3\counter-strike source\hl2.exe"="C:\Programme\Steam\steamapps\trust3\counter-strike source\hl2.exe:*:Enabled:hl2"
"C:\Programme\MSN Messenger\livecall.exe"="C:\Programme\MSN Messenger\livecall.exe:*:Enabled:Windows Live Messenger 8.1 (Phone)"
"C:\Programme\iTunes\iTunes.exe"="C:\Programme\iTunes\iTunes.exe:*:Enabled:iTunes"
"C:\Programme\Windows Live\Messenger\wlcsdk.exe"="C:\Programme\Windows Live\Messenger\wlcsdk.exe:*:Enabled:Windows Live Call"
"C:\WINXP\system32\PnkBstrA.exe"="C:\WINXP\system32\PnkBstrA.exe:*:Enabled:PnkBstrA"
"C:\WINXP\system32\PnkBstrB.exe"="C:\WINXP\system32\PnkBstrB.exe:*:Enabled:PnkBstrB"
"C:\Programme\Curse\CurseClient.exe"="C:\Programme\Curse\CurseClient.exe:*:Enabled:Curse Client"
"C:\Programme\Windows Live\Messenger\msnmsgr.exe"="C:\Programme\Windows Live\Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger"
"C:\Programme\Windows Live\Sync\WindowsLiveSync.exe"="C:\Programme\Windows Live\Sync\WindowsLiveSync.exe:*:Enabled:Windows Live Sync"
"C:\Programme\Pando Networks\Media Booster\PMB.exe"="C:\Programme\Pando Networks\Media Booster\PMB.exe:*:Enabled:Pando Media Booster"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\Programme\MSN Messenger\livecall.exe"="C:\Programme\MSN Messenger\livecall.exe:*:Enabled:Windows Live Messenger 8.1 (Phone)"
"C:\Programme\Windows Live\Messenger\wlcsdk.exe"="C:\Programme\Windows Live\Messenger\wlcsdk.exe:*:Enabled:Windows Live Call"
"C:\Programme\Windows Live\Messenger\msnmsgr.exe"="C:\Programme\Windows Live\Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger"
"C:\Programme\Windows Live\Sync\WindowsLiveSync.exe"="C:\Programme\Windows Live\Sync\WindowsLiveSync.exe:*:Enabled:Windows Live Sync"

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\F]
shell\AutoRun\command - F:\LaunchU3.exe -a

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{71cd15e8-7558-11de-81b8-001fc6a18ffc}]
shell\AutoRun\command - F:\LaunchU3.exe -a


======List of files/folders created in the last 1 months======

2009-12-13 02:17:38 ----D---- C:\rsit
2009-12-07 20:24:53 ----D---- C:\temp
2009-12-07 20:24:39 ----D---- C:\Dokumente und Einstellungen\*** Gab**a\Anwendungsdaten\Audio Record Edit Toolbox
2009-12-07 20:23:22 ----D---- C:\Programme\Zwunzi
2009-12-07 20:23:22 ----D---- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Zwunzi
2009-12-07 20:22:58 ----A---- C:\WINXP\system32\NCTWMAFile2.dll
2009-12-07 20:22:58 ----A---- C:\WINXP\system32\NCTTextToAudio2.dll
2009-12-07 20:22:58 ----A---- C:\WINXP\system32\NCTAudioVisualization2.dll
2009-12-07 20:22:57 ----A---- C:\WINXP\system32\NCTAudioTransform2.dll
2009-12-07 20:22:57 ----A---- C:\WINXP\system32\NCTAudioRecord2.dll
2009-12-07 20:22:57 ----A---- C:\WINXP\system32\NCTAudioPlayer2.dll
2009-12-07 20:22:57 ----A---- C:\WINXP\system32\NCTAudioInformation2.dll
2009-12-07 20:22:57 ----A---- C:\WINXP\system32\NCTAudioFile2.dll
2009-12-07 20:22:57 ----A---- C:\WINXP\system32\NCTAudioEditor2.dll
2009-12-07 20:22:57 ----A---- C:\WINXP\system32\NCTAudioCDGrabber2.dll
2009-12-07 20:22:56 ----D---- C:\Programme\Audio Recorder for FREE
2009-11-26 00:38:16 ----SHD---- C:\Config.Msi
2009-11-26 00:25:56 ----D---- C:\Programme\Adobe
2009-11-25 18:46:20 ----D---- C:\Programme\Microsoft Office
2009-11-22 19:58:53 ----D---- C:\Dokumente und Einstellungen\*** Gab**a\Anwendungsdaten\DivX
2009-11-21 03:30:48 ----N---- C:\WINXP\system32\pxinsi64.exe
2009-11-21 03:30:48 ----N---- C:\WINXP\system32\pxinsa64.exe
2009-11-21 03:30:48 ----N---- C:\WINXP\system32\pxhpinst.exe
2009-11-21 03:30:48 ----N---- C:\WINXP\system32\pxcpyi64.exe
2009-11-21 03:30:48 ----N---- C:\WINXP\system32\pxcpya64.exe
2009-11-21 03:30:48 ----N---- C:\WINXP\system32\pxafs.dll
2009-11-21 03:30:47 ----N---- C:\WINXP\system32\vxblock.dll
2009-11-21 03:30:47 ----N---- C:\WINXP\system32\pxwave.dll
2009-11-21 03:30:47 ----N---- C:\WINXP\system32\pxsfs.dll
2009-11-21 03:30:47 ----N---- C:\WINXP\system32\pxmas.dll
2009-11-21 03:30:47 ----N---- C:\WINXP\system32\pxdrv.dll
2009-11-21 03:30:47 ----N---- C:\WINXP\system32\px.dll
2009-11-21 03:30:07 ----D---- C:\Programme\Gemeinsame Dateien\DivX Shared
2009-11-21 03:30:07 ----D---- C:\Programme\DivX
2009-11-14 05:17:32 ----A---- C:\WINXP\system32\dpl100.dll
2009-11-14 05:17:28 ----A---- C:\WINXP\system32\divx_xx16.dll
2009-11-14 05:17:28 ----A---- C:\WINXP\system32\divx_xx11.dll
2009-11-14 05:17:28 ----A---- C:\WINXP\system32\divx_xx0c.dll
2009-11-14 05:17:28 ----A---- C:\WINXP\system32\divx_xx0a.dll
2009-11-14 05:17:28 ----A---- C:\WINXP\system32\divx_xx07.dll
2009-11-14 05:17:28 ----A---- C:\WINXP\system32\DivX.dll

======List of files/folders modified in the last 1 months======

2009-12-13 02:36:09 ----D---- C:\WINXP\Internet Logs
2009-12-13 02:24:03 ----D---- C:\WINXP\Prefetch
2009-12-13 02:16:51 ----D---- C:\WINXP\Temp
2009-12-13 02:16:51 ----D---- C:\WINXP
2009-12-13 02:08:54 ----D---- C:\Programme\a-squared Free
2009-12-13 02:08:12 ----D---- C:\Programme\Mozilla Firefox
2009-12-13 02:07:40 ----D---- C:\Programme\Steam
2009-12-13 02:06:27 ----D---- C:\WINXP\system32\CatRoot2
2009-12-13 02:05:18 ----N---- C:\WINXP\SchedLgU.Txt
2009-12-13 00:01:26 ----D---- C:\Programme\Silkroad
2009-12-12 21:14:40 ----D---- C:\Dokumente und Einstellungen\***\Anwendungsdaten\Xfire
2009-12-11 19:02:34 ----D---- C:\Programme\Warcraft III
2009-12-07 20:23:22 ----RD---- C:\Programme
2009-12-07 20:22:58 ----D---- C:\WINXP\system32
2009-11-26 00:42:57 ----SHD---- C:\WINXP\Installer
2009-11-26 00:42:41 ----RSD---- C:\WINXP\assembly
2009-11-26 00:41:46 ----RSD---- C:\WINXP\Fonts
2009-11-26 00:41:29 ----D---- C:\Programme\OpenOffice.org 3
2009-11-26 00:26:21 ----D---- C:\Programme\Gemeinsame Dateien\Adobe
2009-11-26 00:26:12 ----D---- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Adobe
2009-11-25 18:46:23 ----D---- C:\Programme\Gemeinsame Dateien\Microsoft Shared
2009-11-24 17:51:26 ----D---- C:\WINXP\Minidump
2009-11-21 03:41:44 ----SD---- C:\WINXP\Tasks
2009-11-21 03:31:26 ----D---- C:\Programme\Google
2009-11-21 03:30:48 ----D---- C:\WINXP\system32\drivers
2009-11-21 03:30:16 ----D---- C:\WINXP\WinSxS
2009-11-21 03:30:07 ----D---- C:\Programme\Gemeinsame Dateien

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R1 AmdK8;AMD-Prozessortreiber; C:\WINXP\system32\DRIVERS\AmdK8.sys [2006-06-18 43520]
R1 avgio;avgio; \??\C:\Programme\Avira\AntiVir Desktop\avgio.sys []
R1 avipbb;avipbb; C:\WINXP\system32\DRIVERS\avipbb.sys [2009-03-30 96104]
R1 kbdhid;Tastatur-HID-Treiber; C:\WINXP\system32\DRIVERS\kbdhid.sys [2008-04-14 14720]
R1 KLIF;KLIF; C:\WINXP\system32\DRIVERS\klif.sys [2007-07-19 127768]
R1 ssmdrv;ssmdrv; C:\WINXP\system32\DRIVERS\ssmdrv.sys [2009-05-11 28520]
R1 vsdatant;vsdatant; C:\WINXP\System32\vsdatant.sys [2008-07-09 394952]
R2 avgntflt;avgntflt; C:\WINXP\system32\DRIVERS\avgntflt.sys [2009-03-24 55640]
R2 fssfltr;FssFltr; C:\WINXP\system32\DRIVERS\fssfltr_tdi.sys [2009-08-05 54752]
R3 AtcL001;NDIS Miniport Driver for Atheros L1 Gigabit Ethernet Controller; C:\WINXP\system32\DRIVERS\l151x86.sys [2007-08-30 36864]
R3 ati2mtag;ati2mtag; C:\WINXP\system32\DRIVERS\ati2mtag.sys [2008-06-03 3100160]
R3 GEARAspiWDM;GEAR ASPI Filter Driver; C:\WINXP\system32\DRIVERS\GEARAspiWDM.sys [2009-03-19 23400]
R3 HDAudBus;Microsoft UAA-Bustreiber für High Definition Audio; C:\WINXP\system32\DRIVERS\HDAudBus.sys [2008-04-13 144384]
R3 hidusb;Microsoft HID Class-Treiber; C:\WINXP\system32\DRIVERS\hidusb.sys [2008-04-14 10368]
R3 IntcAzAudAddService;Service for Realtek HD Audio (WDM); C:\WINXP\system32\drivers\RtkHDAud.sys [2007-08-10 4603904]
R3 MBAMSwissArmy;MBAMSwissArmy; \??\C:\WINXP\system32\drivers\mbamswissarmy.sys []
R3 mouhid;Maus-HID-Treiber; C:\WINXP\system32\DRIVERS\mouhid.sys [2007-10-09 12288]
R3 MTsensor;ATK0110 ACPI UTILITY; C:\WINXP\system32\DRIVERS\ASACPI.sys [2004-08-12 5810]
R3 pcouffin;VSO Software pcouffin; C:\WINXP\System32\Drivers\pcouffin.sys [2009-08-25 47360]
R3 PSI;PSI; C:\WINXP\system32\DRIVERS\psi_mf.sys [2009-03-24 7808]
R3 usbaudio;USB-Audiotreiber (WDM); C:\WINXP\system32\drivers\usbaudio.sys [2008-04-14 60032]
R3 usbccgp;Microsoft Standard-USB-Haupttreiber; C:\WINXP\system32\DRIVERS\usbccgp.sys [2008-04-14 32128]
R3 usbehci;Miniporttreiber für erweiterten Microsoft USB 2.0-Hostcontroller; C:\WINXP\system32\DRIVERS\usbehci.sys [2008-04-14 30208]
R3 usbhub;USB2-aktivierter Hub; C:\WINXP\system32\DRIVERS\usbhub.sys [2008-04-14 59520]
R3 usbohci;Miniporttreiber für Microsoft USB Open Host-Controller; C:\WINXP\system32\DRIVERS\usbohci.sys [2008-04-14 17152]
S3 catchme;catchme; \??\C:\DOKUME~1\CANGAB~1\LOKALE~1\Temp\catchme.sys []
S3 PDNMp50;PDNMp50 NDIS Protocol Driver; \??\C:\WINXP\system32\drivers\PDNMp50.sys []
S3 PDNSp50;PDNSp50 NDIS Protocol Driver; \??\C:\WINXP\system32\drivers\PDNSp50.sys []
S3 SONYPVU1;Sony USB-Filtertreiber (SONYPVU1); C:\WINXP\system32\DRIVERS\SONYPVU1.SYS [2001-08-17 7552]
S3 upperdev;upperdev; C:\WINXP\system32\DRIVERS\usbser_lowerflt.sys []
S3 USBSTOR;USB-Massenspeichertreiber; C:\WINXP\system32\DRIVERS\USBSTOR.SYS [2008-04-14 26368]
S3 Wdf01000;Wdf01000; C:\WINXP\system32\DRIVERS\Wdf01000.sys [2006-11-02 492000]
S3 WudfRd;Windows Driver Foundation - User-mode Driver Framework Reflector; C:\WINXP\system32\DRIVERS\wudfrd.sys [2006-09-15 82688]
S4 IntelIde;IntelIde; C:\WINXP\system32\drivers\IntelIde.sys []

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 a2free;a-squared Free Service; C:\PROGRAMME\A-SQUARED FREE\a2service.exe [2009-11-08 1858144]
R2 AntiVirSchedulerService;Avira AntiVir Planer; C:\Programme\Avira\AntiVir Desktop\sched.exe [2009-05-13 108289]
R2 AntiVirService;Avira AntiVir Guard; C:\Programme\Avira\AntiVir Desktop\avguard.exe [2009-05-11 185089]
R2 Ati HotKey Poller;Ati HotKey Poller; C:\WINXP\system32\Ati2evxx.exe [2008-06-03 552960]
R2 Automatic LiveUpdate Scheduler;Automatic LiveUpdate Scheduler; C:\Programme\Symantec\LiveUpdate\ALUSchedulerSvc.exe [2007-09-12 554352]
R2 JavaQuickStarterService;Java Quick Starter; C:\Programme\Java\jre6\bin\jqs.exe [2009-06-13 152984]
R2 LiveUpdate Notice Service;LiveUpdate Notice Service; C:\Programme\Gemeinsame Dateien\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe [2008-01-29 583048]
R2 PnkBstrA;PnkBstrA; C:\WINXP\system32\PnkBstrA.exe [2009-07-04 75064]
R2 RichVideo;Cyberlink RichVideo Service(CRVS); C:\Programme\CyberLink\Shared Files\RichVideo.exe [2006-12-20 272024]
R2 SeaPort;SeaPort; C:\Programme\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe [2009-01-14 226656]
R2 vsmon;TrueVector Internet Monitor; C:\WINXP\system32\ZoneLabs\vsmon.exe [2008-07-09 75304]
R2 WudfSvc;Windows Driver Foundation - User-mode Driver Framework; C:\WINXP\system32\svchost.exe [2008-04-14 14336]
R3 iPod Service;iPod-Dienst; C:\Programme\iPod\bin\iPodService.exe [2009-05-30 541992]
S2 ATI Smart;ATI Smart; C:\WINXP\system32\ati2sgag.exe [2008-06-02 593920]
S2 gupdate1ca6a353e8650a2;Google Update Service (gupdate1ca6a353e8650a2); C:\Programme\Google\Update\GoogleUpdate.exe [2009-11-21 133104]
S2 LiveUpdate Notice Ex;LiveUpdate Notice Service Ex; C:\Programme\Gemeinsame Dateien\Symantec Shared\ccSvcHst.exe /h ccCommon []
S2 Zwunzi Service;Zwunzi Service; C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Zwunzi\zwunzi131.exe [2009-12-07 58720]
S3 aspnet_state;ASP.NET State Service; C:\WINXP\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe [2005-09-23 29896]
S3 clr_optimization_v2.0.50727_32;.NET Runtime Optimization Service v2.0.50727_X86; C:\WINXP\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe [2005-09-23 66240]
S3 fsssvc;Windows Live Family Safety Service; C:\Programme\Windows Live\Family Safety\fsssvc.exe [2009-08-05 704864]
S3 LiveUpdate;LiveUpdate; C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE [2007-09-12 2999664]
S3 ServiceLayer;ServiceLayer; C:\Programme\PC Connectivity Solution\ServiceLayer.exe [2007-02-08 212480]
S3 WMPNetworkSvc;Windows Media Player-Netzwerkfreigabedienst; C:\Programme\Windows Media Player\WMPNetwk.exe [2006-11-03 920576]

-----------------EOF-----------------

Neuer a-squared free Log:

a-squared Free - Version 4.5
Letztes Update: 12.12.2009 22:35:24

Scan Einstellungen:

Scan Methode: Detail Scan
Objekte: Speicher, Traces, Cookies, C:\
Archiv Scan: An
Heuristik: Aus
ADS Scan: An

Scan Beginn: 13.12.2009 14:52:03

c:\programme\gamespy arcade gefunden: Trace.Directory.GameSpy Arcade!A2
c:\programme\gamespy arcade\profiles gefunden: Trace.Directory.GameSpy Arcade!A2
c:\programme\gamespy arcade\services gefunden: Trace.Directory.GameSpy Arcade!A2
c:\programme\audio recorder for free gefunden: Trace.Directory.Audio Recorder For FREE!A2
Key: HKEY_LOCAL_MACHINE\software\Classes\IMsiDe1egate.Application.1 gefunden: Trace.Registry.AskTBar!A2
Key: HKEY_USERS\S-1-5-21-583907252-1454471165-839522115-1003\software\Microsoft\Windows\CurrentVersion\Ext\Stats\{FE063DB1-4EC0-403E-8DD8-394C54984B2C} gefunden: Trace.Registry.AskTBar!A2
Key: HKEY_USERS\S-1-5-21-583907252-1454471165-839522115-1003\software\Microsoft\Windows\CurrentVersion\Ext\Stats\{FE063DB9-4EC0-403E-8DD8-394C54984B2C} gefunden: Trace.Registry.AskTBar!A2
Key: HKEY_LOCAL_MACHINE\software\32 Vegas Casino gefunden: Trace.Registry.21NovaCasino!A2
c:\programme\zwunzi gefunden: Trace.Directory.Zwunzi!A2
c:\programme\gamespy arcade\banner.html gefunden: Trace.File.GameSpy Arcade!A2
c:\programme\audio recorder for free\lame_enc.dll gefunden: Trace.File.Audio Recorder For FREE!A2
c:\dokumente und einstellungen\*******\desktop\audio recorder for free.lnk gefunden: Trace.File.Audio Recorder For FREE!A2
C:\Dokumente und Einstellungen\*******\Cookies\can_gabsha@weborama[2].txt gefunden: Trace.TrackingCookie.weborama!A2
C:\System Volume Information\_restore{50425EA2-E609-4B1B-A604-1D09F2CDB2F6}\RP345\A0099880.exe gefunden: Trojan-Dropper.SuspectCRC!IK
C:\System Volume Information\_restore{50425EA2-E609-4B1B-A604-1D09F2CDB2F6}\RP345\A0099917.dll gefunden: Gen.AdWare!IK

Gescannt

Dateien: 192417
Traces: 646654
Cookies: 79
Prozesse: 48

Gefunden

Dateien: 2
Traces: 12
Cookies: 1
Prozesse: 0
Registry Keys: 0

Scan Ende: 13.12.2009 16:37:38
Scan Zeit: 1:45:35

BItte um Hilfe